Privacy-preserving Record Linkage Research Articles

Health data space nodes for privacy-preserving linkage of medical data to support collaborative secondary analyses.

The potential for secondary use of health data to improve healthcare is currently not fully exploited. Health data is largely kept in isolated data silos and key infrastructure to aggregate these silos into standardized bodies of knowledge is underdeveloped. We describe the development, implementation, and evaluation of a federated infrastructure to facilitate versatile secondary use of health data based on Health Data Space nodes. Our proposed nodes are self-contained units that digest data through an extract-transform-load framework that pseudonymizes and links data with privacy-preserving record linkage and harmonizes into a common data model (OMOP CDM). To support collaborative analyses a multi-level feature store is also implemented. A feasibility experiment was conducted to test the infrastructures potential for machine learning operations and deployment of other apps (e.g., visualization). Nodes can be operated in a network at different levels of sharing according to the level of trust within the network. In a proof-of-concept study, a privacy-preserving registry for heart failure patients has been implemented as a real-world showcase for Health Data Space nodes at the highest trust level, linking multiple data sources including (a) electronical medical records from hospitals, (b) patient data from a telemonitoring system, and (c) data from Austria's national register of deaths. The registry is deployed at the tirol kliniken, a hospital carrier in the Austrian state of Tyrol, and currently includes 5,004 patients, with over 2.9 million measurements, over 574,000 observations, more than 63,000 clinical free text notes, and in total over 5.2 million data points. Data curation and harmonization processes are executed semi-automatically at each individual node according to data sharing policies to ensure data sovereignty, scalability, and privacy. As a feasibility test, a natural language processing model for classification of clinical notes was deployed and tested. The presented Health Data Space node infrastructure has proven to be practicable in a real-world implementation in a live and productive registry for heart failure. The present work was inspired by the European Health Data Space initiative and its spirit to interconnect health data silos for versatile secondary use of health data.

Privacy-preserving record linkage across disparate institutions and datasets to enable a learning health system: The national COVID cohort collaborative (N3C) experience.

Research driven by real-world clinical data is increasingly vital to enabling learning health systems, but integrating such data from across disparate health systems is challenging. As part of the NCATS National COVID Cohort Collaborative (N3C), the N3C Data Enclave was established as a centralized repository of deidentified and harmonized COVID-19 patient data from institutions across the US. However, making this data most useful for research requires linking it with information such as mortality data, images, and viral variants. The objective of this project was to establish privacy-preserving record linkage (PPRL) methods to ensure that patient-level EHR data remains secure and private when governance-approved linkages with other datasets occur. Separate agreements and approval processes govern N3C data contribution and data access. The Linkage Honest Broker (LHB), an independent neutral party (the Regenstrief Institute), ensures data linkages are robust and secure by adding an extra layer of separation between protected health information and clinical data. The LHB's PPRL methods (including algorithms, processes, and governance) match patient records using "deidentified tokens," which are hashed combinations of identifier fields that define a match across data repositories without using patients' clear-text identifiers. These methods enable three linkage functions: Deduplication, Linking Multiple Datasets, and Cohort Discovery. To date, two external repositories have been cross-linked. As of March 1, 2023, 43 sites have signed the LHB Agreement; 35 sites have sent tokens generated for 9 528 998 patients. In this initial cohort, the LHB identified 135 037 matches and 68 596 duplicates. This large-scale linkage study using deidentified datasets of varying characteristics established secure methods for protecting the privacy of N3C patient data when linked for research purposes. This technology has potential for use with registries for other diseases and conditions.

MRD Assessment in Patients with Newly Diagnosed Multiple Myeloma Using Tokenized Real World Data Sources

Introduction The depth of response in multiple myeloma (MM) after therapy is closely related to the prognosis of the disease. Robust data supports minimal residual disease (MRD) as prognostic after induction, auto-SCT, consolidation; during maintenance therapy; and in the R/R treatment setting. MRD is also prognostic despite unfavorable cytogenetics or transplant eligibility. Accordingly, clinical practice guidelines recommend the assessment of MRD after each phase of treatment, and MRD negativity is increasingly considered an important treatment goal. However, understanding how MRD is currently utilized in routine clinical practice across institutional and community settings is challenging. We have adopted an existing claims-based algorithm and linked MRD test results to explore assessment patterns and attainment of MRD negativity across lines of treatment and patient transplant status in the real-world setting. Methods The study uses Adaptive's internal MRD data linked with HealthVerity closed payer claims data through privacy-preserving record linkage (PPRL) tokenization. PPRL allows for private patient records across different data sources to be linked and shared without transmitting protected health information (PHI). The data source used is Source 20 from the Healthverity Marketplace, representing the largest available source of closed medical and pharmacy claims from health insurers. The data covers 120 million total individuals from over 120 unique payers including commercial, Medicare, and Medicaid, providing a comprehensive treatment journey of the patients. Newly diagnosed MM patients (NDMM) were identified as adults with a diagnosis of MM between January 2015 and December 2022 (the first observed MM diagnosis as Index Diagnosis), with continuous Medical and Pharmacy coverage at least 6 months during pre-index and 12 months during post-index periods. Patients were further required to have initiated MM treatment within 60 days of Index Diagnosis, had at least one MRD assessment using NGS MRD (clonoSEQ® Assay - Adaptive Biotechnologies), and no enrollment in clinical trials nor prior MM treatment pre-index. Lines of therapy were identified following an established algorithm (Fonseca, 2020). We describe patient characteristics, treatment journey, and assessment of MRD test results at a sensitivity of 10 -5 in accordance with IMWG guidance. Results The study identified 244 NDMM patients meeting the above criteria, of which 79 received transplant. Median age was 63 for transplant patients and 65 for non-transplant patients, 60% of all patients were male, and 80% were diagnosed before 2021. The percentage moving to next treatment was greater for transplant patients compared to non-transplant patients (2L: 46%, 3+ line: 19% vs. 2L: 35%, 3+ line: 12%). In both cohorts, front-line therapy usually consisted of an IMiD + dex doublet. For transplant patients, 62% and 46% achieved MRD- at some point during treatment at 10 -5 and 10 -6 thresholds, respectively. Similar MRD- attainment was seen in the non-transplant group (70% and 50%). A total of 562 MRD assessments were performed for these cohorts with a mean of ~2 per patient. The number of patients with >=2 MRD was 50 (63.3%) for transplant, and 91 (55.2%) for non-transplant. Among transplant patients, 88.8% of the MRD tests were performed post-transplant. Among non-transplant patients, 92.9% of the MRD tests were performed on 2L or later. Conclusion This analysis allows us to understand attainment of MRD negativity by transplant status and line of treatment in the real-world setting. Additional data sources are required to confirm outcomes. This study represents the first effort to enrich MRD test results with external claims data sources though tokenized linkage and provides additional patient treatment journey information as identified by the claims data.

Use of Tokens to Unlock Greater Data Sharing in Health Care

This Viewpoint discusses the use of privacy-preserving record linkage, a token-based record linkage system, as a promising avenue for building a data infrastructure system that bridges isolated data.

Creation of a data commons for substance misuse related health research through privacy-preserving patient record linkage between hospitals and state agencies.

Substance misuse is a complex and heterogeneous set of conditions associated with high mortality and regional/demographic variations. Existing data systems are siloed and have been ineffective in curtailing the substance misuse epidemic. Therefore, we aimed to build a novel informatics platform, the Substance Misuse Data Commons (SMDC), by integrating multiple data modalities to provide a unified record of information crucial to improving outcomes in substance misuse patients. The SMDC was created by linking electronic health record (EHR) data from adult cases of substance (alcohol, opioid, nonopioid drug) misuse at the University of Wisconsin hospitals to socioeconomic and state agency data. To ensure private and secure data exchange, Privacy-Preserving Record Linkage (PPRL) and Honest Broker services were utilized. The overlap in mortality reporting among the EHR, state Vital Statistics, and a commercial national data source was assessed. The SMDC included data from 36522 patients experiencing 62594 healthcare encounters. Over half of patients were linked to the statewide ambulance database and prescription drug monitoring program. Chronic diseases accounted for most underlying causes of death, while drug-related overdoses constituted 8%. Our analysis of mortality revealed a 49.1% overlap across the 3 data sources. Nonoverlapping deaths were associated with poor socioeconomic indicators. Through PPRL, the SMDC enabled the longitudinal integration of multimodal data. Combining death data from local, state, and national sources enhanced mortality tracking and exposed disparities. The SMDC provides a comprehensive resource for clinical providers and policymakers to inform interventions targeting substance misuse-related hospitalizations, overdoses, and death.

Social and Health Information Platform: Piloting a Standards-Based, Digital Platform Linking Social Determinants of Health Data into Clinical Workflows for Community-Wide Use.

Social determinants of health (SDoH)a are increasingly recognized as a main contributor to clinical health outcomes, but the technologies and workflows within clinics make it difficult for health care providers to address SDoH needs during routine clinical visits. Our objectives were to pilot a digital platform that matches, links, and visualizes patient-level information and community-level deidentified data from across sectors; establish a technical infrastructure that is scalable, generalizable, and interoperable with new datasets or technologies; employ user-centered codesign principles to refine the platform's visualizations, dashboards, and alerts with community health workers, clinicians, and clinic administrators. We used privacy-preserving record linkage (PPRL) tools to ensure that all identifiable patient data were encrypted, only matched and displayed with consent, and never accessed or stored by the data intermediary. We used limited data sets (LDS) to share nonidentifiable patient data with the data intermediary through a health information exchange (HIE) to take advantage of existing partner agreements, technical infrastructure, and community clinical data. The platform was successfully piloted in two Federally Qualified Health Clinics by 26 clinic staff. SDoH and demographic data from findhelp were successfully linked, matched, and displayed with clinical and demographic data from the HIE, Connxus. Pilot users tested the platform using real-patient data, guiding the refinement of the social and health information platform's visualizations and alerts. Users emphasized the importance of visuals and alerts that gave quick insights into individual patient SDoH needs, survey responses, and clinic-level trends in SDoH service referrals. This pilot shows the importance of PPRL, LDS, and HIE-based data intermediaries in sharing data across sectors and service providers for scalable patient-level care coordination and community-level insights. Clinic staff are integral in designing, developing, and adopting health technologies that will enhance their ability to address SDoH needs within existing workflows without adding undue burdens or additional stress.

SNN-PPRL: A secure record matching scheme based on siamese neural network

With the rapid development of IoT, data from various devices is increasing exponentially. To better apply and analyze IoT data, it is necessary to integrate them from different parties. However, how to match the same entity’s records in huge amounts of data accurately and ensure data privacy has become an urgent problem to be solved. Therefore, privacy preserving record linkage technology is proposed. However, the existing method often has problems in adaptability and linkage quality. We propose the first privacy preserving record linkage scheme based on deep learning techniques. In our scheme, a combined bloom filter module is proposed to encode the data, which can improve security and protect privacy. At the same time, by introducing the record matching module based on siamese neural network, the adaptability and linkage quality are improved. Experiments show that SNN-PPRL can achieve up to 94% matching accuracy and 99% recall.

A Vulnerability Assessment Framework for Privacy-preserving Record Linkage

The linkage of records to identify common entities across multiple data sources has gained increasing interest over the last few decades. In the absence of unique entity identifiers, quasi-identifying attributes such as personal names and addresses are generally used to link records. Due to privacy concerns that arise when such sensitive information is used, privacy-preserving record linkage (PPRL) methods have been proposed to link records without revealing any sensitive or confidential information about these records. Popular PPRL methods such as Bloom filter encoding, however, are known to be susceptible to various privacy attacks. Therefore, a systematic analysis of the privacy risks associated with sensitive databases as well as PPRL methods used in linkage projects is of great importance. In this article we present a novel framework to assess the vulnerabilities of sensitive databases and existing PPRL encoding methods. We discuss five types of vulnerabilities: frequency, length, co-occurrence, similarity, and similarity neighborhood, of both plaintext and encoded values that an adversary can exploit in order to reidentify sensitive plaintext values from encoded data. In an experimental evaluation we assess the vulnerabilities of two databases using five existing PPRL encoding methods. This evaluation shows that our proposed framework can be used in real-world linkage applications to assess the vulnerabilities associated with sensitive databases to be linked, as well as with PPRL encoding methods.

De-identified Bayesian personal identity matching for privacy-preserving record linkage despite errors: development and validation

BackgroundEpidemiological research may require linkage of information from multiple organizations. This can bring two problems: (1) the information governance desirability of linkage without sharing direct identifiers, and (2) a requirement to link databases without a common person-unique identifier.MethodsWe develop a Bayesian matching technique to solve both. We provide an open-source software implementation capable of de-identified probabilistic matching despite discrepancies, via fuzzy representations and complete mismatches, plus de-identified deterministic matching if required. We validate the technique by testing linkage between multiple medical records systems in a UK National Health Service Trust, examining the effects of decision thresholds on linkage accuracy. We report demographic factors associated with correct linkage.ResultsThe system supports dates of birth (DOBs), forenames, surnames, three-state gender, and UK postcodes. Fuzzy representations are supported for all except gender, and there is support for additional transformations, such as accent misrepresentation, variation for multi-part surnames, and name re-ordering. Calculated log odds predicted a proband’s presence in the sample database with an area under the receiver operating curve of 0.997–0.999 for non-self database comparisons. Log odds were converted to a decision via a consideration threshold θ and a leader advantage threshold δ. Defaults were chosen to penalize misidentification 20-fold versus linkage failure. By default, complete DOB mismatches were disallowed for computational efficiency. At these settings, for non-self database comparisons, the mean probability of a proband being correctly declared to be in the sample was 0.965 (range 0.931–0.994), and the misidentification rate was 0.00249 (range 0.00123–0.00429). Correct linkage was positively associated with male gender, Black or mixed ethnicity, and the presence of diagnostic codes for severe mental illnesses or other mental disorders, and negatively associated with birth year, unknown ethnicity, residential area deprivation, and presence of a pseudopostcode (e.g. indicating homelessness). Accuracy rates would be improved further if person-unique identifiers were also used, as supported by the software. Our two largest databases were linked in 44 min via an interpreted programming language.ConclusionsFully de-identified matching with high accuracy is feasible without a person-unique identifier and appropriate software is freely available.

Towards automatic Privacy-Preserving Record Linkage: A Transfer Learning based classification step

Privacy-Preserving Record Linkage (PPRL) intends to identify records that match the same real-world entities across disparate data sources while preserving the privacy of the individual entities. To identify matching records across different data sources and still preserve the privacy of the information, PPRL needs to consider several restrictions due to privacy limitations. For instance, PPRL is executed over anonymized (or encrypted) data to avoid re-identification. Moreover, the classification step of PPRL does not have access to labeled information (indicating if a pair of records is a match) and an oracle (specialist) to label a few instances. These limitations make it hard to employ automatic classification techniques. Most PPRL techniques use a simple threshold (defined by a specialist) to define whether a pair of records represent the same real-world entity or not. To overcome these problems, we present a Transfer Learning-based unsupervised classification step to PPRL, which leverages the information available in public (or synthetic) datasets to train accurate classifiers in a privacy-preserving context. We evaluate our approach using real-world and synthetic data, and the results demonstrate that our unsupervised classification step is able to overcome the most used classification strategies in PPRL.

Strengthening Privacy-Preserving Record Linkage using Diffusion

Linking personal records from different databases is an essential step in many data workflows. Privacy-Preserving Record-Linkage (PPRL) techniques have been developed to link persons despite errors in the identifiers without violating their privacy. Designing efficient PPRL schemes with high linkage quality and a strong level of privacy protection is challenging. PPRL based on Bloom filter encoding (BF) is currently one of the most popular methods as they offer high efficiency and linkage quality. However, it turned out that these schemes are vulnerable to several attacks, with pattern mining and graph matching attacks considered to be the most serious by far. While several proposals have been made to strengthen BF-based PPRL schemes against these attacks, all these lack a proper security analysis or do not preserve the high efficiency and linkage quality. This paper shows that both problems can be addressed by extending the scheme with an appropriate linear diffusion layer. As opposed to previous schemes, we provide extensive theoretical and experimental analysis that confirms that the resulting scheme provides high efficiency and linkage quality and significantly increases security against the attacks mentioned above.

A hierarchical strategy to minimize privacy risk when linking “De-identified” data in biomedical research consortia

Linking data across studies offers an opportunity to enrich data sets and provide a stronger basis for data-driven models for biomedical discovery and/or prognostication. Several techniques to link records have been proposed, and some have been implemented across data repositories holding molecular and clinical data. Not all these techniques guarantee appropriate privacy protection; there are trade-offs between (a) simple strategies that can be associated with data that will be linked and shared with any party and (b) more complex strategies that preserve the privacy of individuals across parties. We propose an intermediary, practical strategy to support linkage in studies that share de-identified data with Data Coordinating Centers. This technology can be extended to link data across multiple data hubs to support privacy preserving record linkage, considering data coordination centers and their awardees, which can be extended to a hierarchy of entities (e.g., awardees, data coordination centers, data hubs, etc.)b.

Relative Effectiveness of Coronavirus Disease 2019 Vaccination and Booster Dose Combinations Among 18.9 Million Vaccinated Adults During the Early Severe Acute Respiratory Syndrome Coronavirus 2 Omicron Period-United States, 1 January 2022 to 31 March 2022.

Small sample sizes have limited prior studies' ability to capture severe COVID-19 outcomes, especially among Ad26.COV2.S vaccine recipients. This study of 18.9 million adults aged ≥18 years assessed relative vaccine effectiveness (rVE) in three recipient cohorts: (1) primary Ad26.COV2.S vaccine and Ad26.COV2.S booster (2 Ad26.COV2.S), (2) primary Ad26.COV2.S vaccine and mRNA booster (Ad26.COV2.S+mRNA), (3) two doses of primary mRNA vaccine and mRNA booster (3 mRNA). We analyzed two de-identified datasets linked using privacy-preserving record linkage (PPRL): insurance claims and retail pharmacy COVID-19 vaccination data. We assessed the presence of COVID-19 diagnosis during January 1-March 31, 2022 in: (1) any claim, (2) outpatient claim, (3) emergency department (ED) claim, (4) inpatient claim, and (5) inpatient claim with intensive care unit (ICU) admission. rVE for each outcome comparing three recipient cohorts (reference: two Ad26.COV2.S doses) was estimated from adjusted Cox proportional hazards models. Compared with two Ad26.COV2.S doses, Ad26.COV2.S+mRNA and three mRNA doses were more effective against all COVID-19 outcomes, including 57% (95% CI: 52-62) and 62% (95% CI: 58-65) rVE against an ED visit; 44% (95% CI: 34-52) and 54% (95% CI: 48-59) rVE against hospitalization; and 48% (95% CI: 22-66) and 66% (95% CI: 53-75) rVE against ICU admission, respectively. This study demonstrated that Ad26.COV2.S + mRNA doses were as good as three doses of mRNA, and better than two doses of Ad26.COV2.S. Vaccination continues to be an important preventive measure for reducing the public health impact of COVID-19.

Privacy-preserving record linkage using autoencoders

Privacy-preserving record linkage (PPRL) is the process aimed at identifying records that represent the same real-world entity across different data sources while guaranteeing the privacy of sensitive information about these entities. A popular PPRL method is to encode sensitive plain-text data into Bloom filters (BFs), bit vectors that enable the efficient calculation of similarities between records that is required for PPRL. However, BF encoding cannot completely prevent the re-identification of plain-text values because sets of BFs can contain bit patterns that can be mapped to plain-text values using cryptanalysis attacks. Various hardening techniques have therefore been proposed that modify the bit patterns in BFs with the aim to prevent such attacks. However, it has been shown that even hardened BFs can still be vulnerable to attacks. To avoid any such attacks, we propose a novel encoding technique for PPRL based on autoencoders that transforms BFs into vectors of real numbers. To achieve a high comparison quality of the generated numerical vectors, we propose a method that guarantees the comparability of encodings generated by the different data owners. Experiments on real-world data sets show that our technique achieves high linkage quality and prevents known cryptanalysis attacks on BF encoding.

Assessing the impact of privacy-preserving record linkage on record overlap and patient demographic and clinical characteristics in PCORnet®, the National Patient-Centered Clinical Research Network.

This article describes the implementation of a privacy-preserving record linkage (PPRL) solution across PCORnet®, the National Patient-Centered Clinical Research Network. Using a PPRL solution from Datavant, we quantified the degree of patient overlap across the network and report a de-duplicated analysis of the demographic and clinical characteristics of the PCORnet population. There were ∼170M patient records across the responding Network Partners, with ∼138M (81%) of those corresponding to a unique patient. 82.1% of patients were found in a single partner and 14.7% were in 2. The percentage overlap between Partners ranged between 0% and 80% with a median of 0%. Linking patients' electronic health records with claims increased disease prevalence in every clinical characteristic, ranging between 63% and 173%. The overlap between Partners was variable and depended on timeframe. However, patient data linkage changed the prevalence profile of the PCORnet patient population. This project was one of the largest linkage efforts of its kind and demonstrates the potential value of record linkage. Linkage between Partners may be most useful in cases where there is geographic proximity between Partners, an expectation that potential linkage Partners will be able to fill gaps in data, or a longer study timeframe.

Validating a novel deterministic privacy-preserving record linkage between administrative & clinical data: applications in stroke research.

Research data combined with administrative data provides a robust resource capable of answering unique research questions. However, in cases where personal health data are encrypted, due to ethics requirements or institutional restrictions, traditional methods of deterministic and probabilistic record linkages are not feasible. Instead, privacy-preserving record linkages must be used to protect patients' personal data during data linkage. To determine the feasibility and validity of a deterministic privacy preserving data linkage protocol using homomorphically encrypted data. Feasibility was measured by the number of records that successfully matched via direct identifiers. Validity was measured by the number of records that matched with multiple indirect identifiers. The threshold for feasibility and validity were both set at 95%. The datasets shared a single, direct identifier (health card number) and multiple indirect identifiers (sex and date of birth). Direct identifiers were encrypted in both datasets and then transferred to a third-party server capable of linking the encrypted identifiers without decrypting individual records. Once linked, the study team used indirect identifiers to verify the accuracy of the linkage in the final dataset. With a combination of manual and automated data transfer in a sample of 8,128 individuals, the privacy-preserving data linkage took 36 days to match to a population sample of over 3.2 million records. 99.9% of the records were successfully matched with direct identifiers, and 99.8% successfully matched with multiple indirect identifiers. We deemed the linkage both feasible and valid. As combining administrative and research data becomes increasingly common, it is imperative to understand options for linking data when direct linkage is not feasible. The current linkage process ensured the privacy and security of patient data and improved data quality. While the initial implementations required significant computational and human resources, increased automation keeps the requirements within feasible bounds.

Record linkage based patient intersection cardinality for rare disease studies using Mainzelliste and secure multi-party computation

BackgroundThe low number of patients suffering from any given rare diseases poses a difficult problem for medical research: With the exception of some specialized biobanks and disease registries, potential study participants’ information are disjoint and distributed over many medical institutions. Whenever some of those facilities are in close proximity, a significant overlap of patients can reasonably be expected, further complicating statistical study feasibility assessments and data gathering. Due to the sensitive nature of medical records and identifying data, data transfer and joint computations are often forbidden by law or associated with prohibitive amounts of effort. To alleviate this problem and to support rare disease research, we developed the Mainzelliste Secure EpiLinker (MainSEL) record linkage framework, a secure Multi-Party Computation based application using trusted-third-party-less cryptographic protocols to perform privacy-preserving record linkage with high security guarantees. In this work, we extend MainSEL to allow the record linkage based calculation of the number of common patients between institutions. This allows privacy-preserving statistical feasibility estimations for further analyses and data consolidation. Additionally, we created easy to deploy software packages using microservice containerization and continuous deployment/continuous integration. We performed tests with medical researchers using MainSEL in real-world medical IT environments, using synthetic patient data.ResultsWe show that MainSEL achieves practical runtimes, performing 10 000 comparisons in approximately 5 minutes. Our approach proved to be feasible in a wide range of network settings and use cases. The “lessons learned” from the real-world testing show the need to explicitly support and document the usage and deployment for both analysis pipeline integration and researcher driven ad-hoc analysis use cases, thus clarifying the wide applicability of our software. MainSEL is freely available under: https://github.com/medicalinformatics/MainSELConclusionsMainSEL performs well in real-world settings and is a useful tool not only for rare disease research, but medical research in general. It achieves practical runtimes, improved security guarantees compared to existing solutions, and is simple to deploy in strict clinical IT environments. Based on the “lessons learned” from the real-word testing, we hope to enable a wide range of medical researchers to meet their needs and requirements using modern privacy-preserving technologies.

The Data-Adaptive Fellegi-Sunter Model for Probabilistic Record Linkage: Algorithm Development and Validation for Incorporating Missing Data and Field Selection.

BackgroundQuality patient care requires comprehensive health care data from a broad set of sources. However, missing data in medical records and matching field selection are 2 real-world challenges in patient-record linkage.ObjectiveIn this study, we aimed to evaluate the extent to which incorporating the missing at random (MAR)–assumption in the Fellegi-Sunter model and using data-driven selected fields improve patient-matching accuracy using real-world use cases.MethodsWe adapted the Fellegi-Sunter model to accommodate missing data using the MAR assumption and compared the adaptation to the common strategy of treating missing values as disagreement with matching fields specified by experts or selected by data-driven methods. We used 4 use cases, each containing a random sample of record pairs with match statuses ascertained by manual reviews. Use cases included health information exchange (HIE) record deduplication, linkage of public health registry records to HIE, linkage of Social Security Death Master File records to HIE, and deduplication of newborn screening records, which represent real-world clinical and public health scenarios. Matching performance was evaluated using the sensitivity, specificity, positive predictive value, negative predictive value, and F1-score.ResultsIncorporating the MAR assumption in the Fellegi-Sunter model maintained or improved F1-scores, regardless of whether matching fields were expert-specified or selected by data-driven methods. Combining the MAR assumption and data-driven fields optimized the F1-scores in the 4 use cases.ConclusionsMAR is a reasonable assumption in real-world record linkage applications: it maintains or improves F1-scores regardless of whether matching fields are expert-specified or data-driven. Data-driven selection of fields coupled with MAR achieves the best overall performance, which can be especially useful in privacy-preserving record linkage.

On the effectiveness of graph matching attacks against privacy-preserving record linkage.

Linking several databases containing information on the same person is an essential step of many data workflows. Due to the potential sensitivity of the data, the identity of the persons should be kept private. Privacy-Preserving Record-Linkage (PPRL) techniques have been developed to link persons despite errors in the identifiers used to link the databases without violating their privacy. The basic approach is to use encoded quasi-identifiers instead of plain quasi-identifiers for making the linkage decision. Ideally, the encoded quasi-identifiers should prevent re-identification but still allow for a good linkage quality. While several PPRL techniques have been proposed so far, Bloom filter-based PPRL schemes (BF-PPRL) are among the most popular due to their scalability. However, a recently proposed attack on BF-PPRL based on graph similarities seems to allow individuals’ re-identification from encoded quasi-identifiers. Therefore, the graph matching attack is widely considered a serious threat to many PPRL-approaches and leads to the situation that BF-PPRL schemes are rejected as being insecure. In this work, we argue that this view is not fully justified. We show by experiments that the success of graph matching attacks requires a high overlap between encoded and plain records used for the attack. As soon as this condition is not fulfilled, the success rate sharply decreases and renders the attacks hardly effective. This necessary condition does severely limit the applicability of these attacks in practice and also allows for simple but effective countermeasures.

Semantic-based Privacy-preserving Record Linkage.

IntroductionSharing aggregated electronic health records (EHRs) for integrated health care and public health studies is increasingly demanded. Patient privacy demands that anonymisation procedures are in place for data sharing.
 ObjectiveTraditional methods such as k-anonymity and its derivations are often overgeneralising resulting in lower data accuracy. To tackle this issue, we proposed the Semantic Linkage K-Anonymity (SLKA) approach to balance the privacy and utility preservation through detecting risky combinations hidden in the record linkage releases.
 ApproachK-anonymity processing quasi-identifiers of data may lead to ‘over generalisation’ when dealing with linkage data sets. As most linkage cases do not include all local patients and thus not all modifying data for privacy-preserving purposes needs to be used, we proposed the linkage k-anonymity (LKA) by which only obfuscated individuals in a released linkage set are required to be indistinguishable from at least k-1 other individuals in the local dataset. Considering the inference disclosure issue, we further designed the semantic-based linkage k-anonymity (SLKA) method through extending with a semantic-rule base for automatic detection of (and ruling out) risky associations from previous linked data releases. Specially, associations identified from the “previous releases” of the linkage dataset can become the input of semantic reasoning for the “next release”.
 ResultsThe approach is evaluated based on a linkage scenario where researchers apply to link data from an Australia-wide national type-1 diabetes platform with survey results from 25,000+ Victorians about their health and wellbeing. In comparing the information loss of three methods, we find that extra cost can be incurred in SLKA for dealing with risky individuals, e.g., 13.7% vs 5.9% (LKA, k=4) however it performs much better than k-anonymity, which can cause 24% information loss (k=4). Besides, the k values can affect the level of distortion in SLKA, such as 11.5% (k=2) vs 12.9% (k=3).
 ConclusionThe SLKA framework provides dynamic protection for repeated linkage releases while preserving data utility by avoiding unnecessary generalisation as typified by k-anonymity.